diff --git a/e2e/.snyk b/e2e/.snyk
new file mode 100644
index 0000000000..6d7838b568
--- /dev/null
+++ b/e2e/.snyk
@@ -0,0 +1,21 @@
+# Snyk (https://snyk.io) policy file.
+# These advisories live in the Cypress e2e test harness only. The code never
+# ships to users and never runs in production — it executes in CI against known
+# fixture files, not attacker-controlled input. xlsx (SheetJS) has no published
+# npm fix. Re-review on expiry.
+version: v1.25.0
+ignore:
+  SNYK-JS-XLSX-6252523:
+    - '*':
+        reason: >-
+          ReDoS in xlsx. Test-only dependency (Cypress e2e); never shipped,
+          never processes untrusted input. No npm fix available (SheetJS
+          distributes fixes via their own CDN only).
+        expires: 2027-06-11T00:00:00.000Z
+  SNYK-JS-XLSX-5457926:
+    - '*':
+        reason: >-
+          Prototype pollution in xlsx. Test-only dependency (Cypress e2e); never
+          shipped, never processes untrusted input. No npm fix available
+          (SheetJS distributes fixes via their own CDN only).
+        expires: 2027-06-11T00:00:00.000Z
diff --git a/webapp/.snyk b/webapp/.snyk
new file mode 100644
index 0000000000..d59ef9fe73
--- /dev/null
+++ b/webapp/.snyk
@@ -0,0 +1,31 @@
+# Snyk (https://snyk.io) policy file.
+# Documented risk-acceptances for advisories with no clean upstream fix. These
+# are browser-side issues whose only input crosses no trust boundary, so the
+# real-world impact is negligible. Re-review on expiry.
+version: v1.25.0
+ignore:
+  SNYK-JS-ZXCVBN-3257741:
+    - '*':
+        reason: >-
+          ReDoS in the client-side password-strength estimator. The only input
+          is the user's own password as they type it, so the worst case is a
+          user slowing down their own browser tab. No cross-user or server
+          impact. zxcvbn is unmaintained with no patched release; migrating to
+          @zxcvbn-ts/core is tracked as separate tech-debt.
+        expires: 2027-06-11T00:00:00.000Z
+  SNYK-JS-INFLIGHT-6095116:
+    - '*':
+        reason: >-
+          Memory leak in a deprecated package reached only via
+          react-query > broadcast-channel > rimraf > glob, a Node-only
+          leader-election path that is not exercised in the browser bundle. No
+          upstream fix exists (package is deprecated).
+        expires: 2027-06-11T00:00:00.000Z
+  SNYK-JS-D3COLOR-1076592:
+    - '*':
+        reason: >-
+          ReDoS in d3-color via recharts. The parsed color strings come from the
+          app's own chart configuration, not attacker-controlled input. The fix
+          requires a major d3 bump that risks breaking recharts; deferred as
+          low-risk.
+        expires: 2027-06-11T00:00:00.000Z